<div dir="ltr"><div>Hi Ivan,</div><div><br></div><div>Okay, I see what you mean.</div><div>The thing is that the default-network-drivers() source in your config is automatically and seamlessly expanded to a series of syslog() and network() sources definitions.</div><div>The syslog(...) and network(...) statements I mentioned eariler were source definitions as well.</div><div><br></div><div>In order to get a more thorough look at your use-case, I would kindly request you to send (either to me privately, or to this mailing list) a packet dump of the Huawei device's logs so that I can identify which port the traffic is destined to (and through which protocol), and what the actual format of the logs is.</div><div><br></div><div>You can either do this by</div><div>* running tcpdump ( tcpdump -peni any -v -w /tmp/syslog.pcap "port 514 or port 601" ), or</div><div>* by downloading (if the script wasn't already deployed along your syslog-ng installation) and running <a href="https://raw.githubusercontent.com/syslog-ng/syslog-ng/master/contrib/syslog-ng-debun">syslog-ng-debun</a> ( syslog-ng-debun -r -p -t 300 ) (this will run the information gathering script for 5 minutes, and it will try to do the packet capture for you)</div><div><br></div><div>Thanks!</div><div><br></div><div>Best Regards,</div><div>János Szigetvári<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Ivan Nepryahin - Bercut <<a href="mailto:Ivan.Nepryahin@bercut.com">Ivan.Nepryahin@bercut.com</a>> ezt írta (időpont: 2021. márc. 25., Cs, 16:38):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div id="gmail-m_606940339469346016divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p>Thanks for your reply, <span>János !</span></p>
<p><span><br>
</span></p>
<p><span>If you can explain me please what does that mean?</span></p>
<p><span><br>
</span></p>
<p><span></span></p>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px">
</div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px">
>network(transport(tcp|udp))</div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px">
>or</div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px">
>syslog() or network(transport(tcp|udp) flags(syslog-protocol))</div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px">
</div>
<br>
<p></p>
<p><span><br>
</span></p>
<p><br>
</p>
<p><span><br>
</span></p>
<p><span>======================================================================</span></p>
<p><span><br>
</span></p>
<p><span>my config:</span></p>
<p><span><br>
</span></p>
<p><span><span style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px"></span></span></p>
<div><br>
</div>
<div>@version: 3.18</div>
<div>@include "scl.conf"</div>
<div><br>
</div>
<div>source s_local {</div>
<div> internal();</div>
<div>};</div>
<div><br>
</div>
<div>source s_network {</div>
<div> default-network-drivers(</div>
<div> # NOTE: TLS support</div>
<div> #</div>
<div> # the default-network-drivers() source driver opens the TLS</div>
<div> # enabled ports as well, however without an actual key/cert</div>
<div> # pair they will not operate and syslog-ng would display a</div>
<div> # warning at startup.</div>
<div> #</div>
<div> #tls(key-file("/path/to/ssl-private-key") cert-file("/path/to/ssl-cert"))</div>
<div> );</div>
<div>};</div>
<div><br>
</div>
<div>destination d_local {</div>
<div># file("/var/log/messages");</div>
<div> file("/var/log/messages-kv_${YEAR}-${MONTH}-${DAY}.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));</div>
<div> file("/var/log/messages_${HOST}.log"</div>
<div> perm(0644)</div>
<div> );</div>
<div>};</div>
<div><br>
</div>
<div>destination d_logstore {</div>
<div> file(</div>
<div> "/var/log/remote/${HOST}/${HOST}_${YEAR}-${MONTH}-${DAY}.log"</div>
<div> create-dirs(yes)</div>
<div> );</div>
<div>};</div>
<div><br>
</div>
<div>log {</div>
<div> source(s_local);</div>
<div> source(s_network);</div>
<div> destination(d_local);</div>
<div> destination(d_logstore);</div>
<div># destination(d_sorted);</div>
<div>};</div>
<div><br>
</div>
<br>
<p></p>
<p><br>
</p>
<div id="gmail-m_606940339469346016Signature">
<div id="gmail-m_606940339469346016divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p></p>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#2E74B5"><span style="font-size:10pt"><span style="font-size:10pt">best regards</span><span style="font-size:10pt">,</span></span></font></span></font></div>
<span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#0073AF"><span style="font-size:10pt" lang="en-US"><b>Nepryahin Ivan</b></span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:10pt" lang="en-US">IT Department</span></font></span></font></div>
<span style="font-size:10pt"></span><span style="font-size:9pt"></span><span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Phone</b></span></font><font style="font-family:"Cambria Math",serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7
812 327 32 33</span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Mobile: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7 </span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:8pt" lang="en-US">911
291 81 68</span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"></span></font></span></font></div>
<br>
<p></p>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_606940339469346016divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of SZIGETVÁRI János <<a href="mailto:jszigetvari@gmail.com" target="_blank">jszigetvari@gmail.com</a>><br>
<b>Sent:</b> Thursday, March 25, 2021 6:24:09 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng has add extra field</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hello Ivan,</div>
<div><br>
</div>
<div>Most commonly there may be two main formats of logs that you may encounter.</div>
<div>One is the traditional BSD-style syslog, described in RFC 3164: <a href="https://tools.ietf.org/html/rfc3164" target="_blank">
https://tools.ietf.org/html/rfc3164</a></div>
<div>The other is the IETF-style log format, described in RFC 5424: <a href="https://tools.ietf.org/html/rfc5424" target="_blank">
https://tools.ietf.org/html/rfc5424</a></div>
<div><br>
</div>
<div>In case of syslog-ng you would have to either use</div>
<div>network(transport(tcp|udp))</div>
<div>or</div>
<div>syslog() or network(transport(tcp|udp) flags(syslog-protocol))</div>
<div>respectively.</div>
<div><br>
</div>
<div>The sample logs you included seem to resemble the IETF-style.</div>
<div>What type of source do you have configured in your syslog-ng setup? (Could you please share your config file?)</div>
<div><br>
</div>
<div>Best Regards,</div>
<div>János<br>
</div>
<div>
<div>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">--</div>
<div dir="ltr">Janos SZIGETVARI<br>
<span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">
150-053-692</a></span><br>
</div>
<div dir="ltr"><span><br>
</span></div>
<div dir="ltr"><span>LinkedIn: <a href="http://linkedin.com/in/janosszigetvari" target="_blank">
linkedin.com/in/janosszigetvari</a></span><br>
E-mail: <a href="mailto:janos@szigetvari.com" target="_blank">janos@szigetvari.com</a>,
<a href="mailto:jszigetvari@gmail.com" target="_blank">jszigetvari@gmail.com</a></div>
<div dir="ltr">Web: <a href="https://janos.szigetvari.com" target="_blank">janos.szigetvari.com</a><br>
<br>
__@__˚V˚<br>
Make the switch to open (source) applications, protocols, formats now:<br>
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>
- msn -> jabber protocol (Pidgin, Google Talk)<br>
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">Ivan Nepryahin - Bercut <<a href="mailto:Ivan.Nepryahin@bercut.com" target="_blank">Ivan.Nepryahin@bercut.com</a>> ezt írta (időpont: 2021. márc. 25., Cs, 14:56):<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_606940339469346016gmail-m_4841975196670874397gmail-m_-6357573219866753876divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p></p>
<div></div>
<div>Hi all!</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I think I have a stupid question, but I really dont know how this make.</div>
<div><br>
</div>
<div>Situation: </div>
<div>When I send syslog message with timestamp in format "1Mar 25 2021 16:35:49" everything works great, but when I send message with timestamp in format "1Mar 25 2021 16:35:49<b>+03:00</b>", syslog-ng adding two extra fields with timestamp and IP address
and due that break down file naming.</div>
<div><br>
</div>
<div>Question:</div>
<div>How can I say to syslog-ng server do not add extra fields when he get message with +03:00 in timestamp?</div>
<div><br>
</div>
<div>message without +03:00</div>
<div></div>
<span>Mar 25 13:11:57 HUAWEI-CORE-OFFICE-1 <bla bla bal></span>
<div><br>
</div>
<div>mesage with <span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">+03:00 </span></div>
<div><span><span>Mar 25 13:46:45 192.168.100.34 Mar 25 2021 16:46:45<b>+03:00</b> HUAWEI-CORE-OFFICE-1 </span> <bla bla bla></span><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div></div>
<span>I will be appreciate for any advice!</span><br>
<p></p>
<p><span><br>
</span></p>
<p><span><br>
</span></p>
<p><span>P.s sorry for bad english it is not my native language </span></p>
<p><br>
</p>
<p><br>
</p>
<div id="gmail-m_606940339469346016gmail-m_4841975196670874397gmail-m_-6357573219866753876Signature">
<div id="gmail-m_606940339469346016gmail-m_4841975196670874397gmail-m_-6357573219866753876divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p></p>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#2E74B5"><span style="font-size:10pt"><span style="font-size:10pt">best regards</span><span style="font-size:10pt">,</span></span></font></span></font></div>
<span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#0073AF"><span style="font-size:10pt" lang="en-US"><b>Nepryahin Ivan</b></span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:10pt" lang="en-US">IT Department</span></font></span></font></div>
<span style="font-size:10pt"></span><span style="font-size:9pt"></span><span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Phone</b></span></font><font style="font-family:"Cambria Math",serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7
812 327 32 33</span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Mobile: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7 </span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:8pt" lang="en-US">911
291 81 68</span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"></span></font></span></font></div>
<br>
<p></p>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>